Anomaly monitoring methods, model training methods, devices, equipment and storage media

Abstract

This application provides an anomaly detection method, model training method, apparatus, device, and storage medium. The anomaly detection method is used to detect anomalies in packets and determine whether an anomaly has occurred. Specifically, after acquiring the target packet to be judged, features of the target packet can first be extracted according to a preset feature type. Then, the features extracted from the target packet can be input into a Recurrent Neural Network (RNN) model. The RNN model analyzes the features of the target packet to obtain the anomaly detection result. In this way, by extracting specific features from the target packet according to a preset feature type for anomaly detection, accurate anomaly detection results can be obtained.

Description

Technical Field

[0001] This application relates to the field of anomaly monitoring technology, and in particular to an anomaly monitoring method, model training method, device, equipment and storage medium. Background Technology

[0002] Monitoring network message anomalies is a crucial step in ensuring the normal operation of business. This is especially true for financial institutions such as banks, where financial transactions are involved; anomalies in transaction messages can lead to financial losses for users. Therefore, monitoring transaction message anomalies is extremely important, and timely detection of such anomalies is essential.

[0003] In some implementations, artificial intelligence technology can be used to detect anomalies in transaction messages. Specifically, the model can be trained in advance using both anomaly-prone and normal transaction messages. Through the training process, the model learns the characteristics of anomaly-prone messages. After generating new transaction messages, the model can then perform anomaly detection on these new messages. In this way, anomaly detection of messages can be achieved to a certain extent.

[0004] The above process requires feature extraction from the message, followed by identification based on the extracted features. However, in real-world scenarios, transaction messages can be quite complex, and multiple features may be extracted from them, leading to poor accuracy in anomaly detection. Summary of the Invention

[0005] In view of this, this application provides an anomaly monitoring method, model training method, apparatus, device and storage medium, which are intended to accurately monitor messages for anomalies.

[0006] Firstly, this application provides an anomaly monitoring method, the method comprising:

[0007] Obtain the target message;

[0008] The target message is subjected to feature extraction according to a preset feature type to obtain multiple preset features of the target message. The preset feature type is determined based on the analysis of abnormal messages using a decision tree.

[0009] Multiple preset features of the target message are input into a recurrent neural network (RNN) model to obtain the anomaly monitoring results of the target message.

[0010] In some possible implementations, the preset feature type is obtained by analyzing the influence of message features on anomalies using the Random Forest (FR) algorithm, and the recurrent neural network (RNN) model includes the bidirectional recurrent neural network (BIRNN) model.

[0011] Secondly, this application provides a model training method, the method comprising:

[0012] Acquire multiple sample messages, including multiple abnormal sample messages and multiple normal sample messages;

[0013] Determine multiple types of original features of the sample message and candidate values ​​for each type of original feature, wherein each sample message includes the multiple types of original features;

[0014] Based on the multiple original features, a feature decision tree is determined. The branch nodes of the feature decision tree correspond one-to-one with the original features, and the number of branches of the corresponding branch nodes is the same as the number of candidate values ​​of the original features.

[0015] Based on the feature decision tree, analyze the degree of influence of each original feature on the anomaly of the message;

[0016] Based on the degree of influence, multiple target features are determined from the multiple original features;

[0017] The target features of each sample message are extracted, and a recurrent neural network (RNN) model is trained based on the abnormal features of the target features. The RNN model is used to detect anomalies in the message based on the target features of the message.

[0018] In some possible implementations, the original features include target original features, the candidate values ​​of the target original features include target candidate values, and the analysis of the influence of each original feature on the message anomaly based on the feature decision tree includes:

[0019] The sample message set is analyzed to determine the number of normal sample messages and the number of abnormal sample messages corresponding to each candidate value of the target original feature;

[0020] Based on the number of normal sample messages and the number of abnormal sample messages, the degree of influence of the target candidate value on the message abnormality is determined.

[0021] Thirdly, this application provides an anomaly monitoring device, the device comprising:

[0022] The acquisition unit is used to acquire the target message;

[0023] The feature extraction unit is used to extract features from the target message according to a preset feature type to obtain multiple preset features of the target message. The preset feature type is determined based on the analysis of abnormal messages using a decision tree.

[0024] The model monitoring unit is used to input multiple preset features of the target message into a recurrent neural network (RNN) model to obtain the anomaly monitoring results of the target message.

[0025] In some possible implementations, the preset feature type is obtained by analyzing the influence of message features on anomalies using the Random Forest (FR) algorithm, and the recurrent neural network (RNN) model includes the bidirectional recurrent neural network (BIRNN) model.

[0026] Fourthly, this application provides a model training apparatus, the apparatus comprising:

[0027] The acquisition unit is used to acquire multiple sample messages, including multiple abnormal sample messages and multiple normal sample messages;

[0028] A feature determination unit is used to determine multiple types of original features of the sample message and candidate values ​​for each type of original feature, wherein each sample message includes the multiple types of original features;

[0029] The decision tree building unit is used to determine a feature decision tree based on the multiple original features. The branch nodes of the feature decision tree correspond one-to-one with the original features, and the number of branches of the corresponding branch nodes is the same as the number of candidate values ​​of the original features.

[0030] An impact analysis unit is used to analyze the degree of impact of each original feature on the anomaly of the message based on the feature decision tree.

[0031] A feature filtering unit is used to determine multiple target features from the multiple original features based on the degree of influence.

[0032] The model training unit is used to extract the target features of each sample message and train a recurrent neural network (RNN) model based on the abnormal features of the target features. The RNN model is used to perform anomaly detection on the message based on the target features of the message.

[0033] In some possible implementations, the original feature includes the target original feature, and the candidate values ​​of the target original feature include the target candidate values.

[0034] The influence analysis unit is specifically used to analyze the sample message set, determine the number of normal sample messages and the number of abnormal sample messages corresponding to each candidate value of the target original feature; and determine the influence degree of the target candidate value on the message abnormality based on the number of normal sample messages and the number of abnormal sample messages.

[0035] Fifthly, this application provides an apparatus comprising a memory and a processor, the memory for storing instructions or code, and the processor for executing the instructions or code to cause the apparatus to perform the anomaly monitoring method described in any of the first aspects, or to implement the model training method described in any of the second aspects.

[0036] Sixthly, this application provides a computer storage medium storing code, wherein when the code is executed, a device running the code implements the anomaly monitoring method described in any of the first aspects above, or implements the model training method described in any of the second aspects above.

[0037] In a seventh aspect, a computer program product containing instructions is provided, which, when run on a computer, causes the computer to execute the anomaly monitoring method described in any of the first aspects, or to implement the model training method described in any of the second aspects.

[0038] This application provides an anomaly detection method, model training method, apparatus, device, and storage medium. The anomaly detection method is used to detect anomalies in messages and determine whether a message has become abnormal. Specifically, after acquiring the target message to be judged, features of the target message can first be extracted according to preset feature types. Then, the features extracted from the target message can be input into a Recurrent Neural Network (RNN) model. The RNN model analyzes the features of the target message to obtain the anomaly detection result. The preset feature types are determined based on the analysis of anomaly-causing messages using decision trees, and are the types of features among the various features of the target message that have the highest correlation with anomalies. Therefore, by extracting features from the target message based on preset feature types, multiple preset features with the highest correlation with anomalies can be found from the target message. Because of their high correlation with anomalies, preset features can better reflect whether the target message has become abnormal compared to non-preset features. Thus, by extracting specific features from the target message according to preset feature types for anomaly detection, accurate anomaly detection results can be obtained. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings used in the description of the embodiment or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 A flowchart illustrating an anomaly monitoring method provided in an embodiment of this application;

[0041] Figure 2 A schematic flowchart of a model training method provided in an embodiment of this application;

[0042] Figure 3 A schematic diagram of the anomaly monitoring device provided in the embodiments of this application;

[0043] Figure 4 This is a schematic diagram of a model training device used in an embodiment of this application. Detailed Implementation

[0044] Currently, anomaly detection of messages can be performed using artificial intelligence models such as neural network models. When performing anomaly detection using artificial intelligence models, features in the message can be extracted, and the anomaly of the message can be determined based on these features.

[0045] However, there are many types of messages, and even messages of the same type may have different formats. This results in messages having multiple types of features, and the same feature may have multiple values. Messages with the same value can include both normal and abnormal messages. Thus, due to the complexity of sample messages, the features extracted from sample messages are difficult to use for anomaly detection, leading to inaccuracies in traditional anomaly detection methods.

[0046] To address the aforementioned problems, embodiments of this application provide an anomaly detection method and a model training method. The model training method determines the type of features to be extracted and trains the corresponding model. The anomaly detection method extracts features based on the predetermined feature types and uses the trained model for anomaly detection.

[0047] This anomaly detection method can be applied to anomaly detection devices. Optionally, the anomaly detection device can run on a server, specifically a monitoring server processing a cluster. The model training method can also be applied to the server.

[0048] The anomaly monitoring method provided in this application will be described below from the perspective of an anomaly monitoring device. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0049] See Figure 1 , Figure 1 A flowchart of one method of the anomaly monitoring method provided in the embodiments of this application includes:

[0050] S101: Obtain the target message.

[0051] In this embodiment of the application, the message to be monitored can be referred to as the target message. Accordingly, the anomaly monitoring device can acquire the target message to be monitored.

[0052] After obtaining the target message, before feature extraction, it can be preprocessed, such as by performing format conversion and data cleaning. This unifies target messages of different formats from different systems, facilitating subsequent processing.

[0053] S102: Extract features from the target message according to the preset feature type to obtain multiple preset features of the target message.

[0054] Before identification using a model, feature extraction can be performed on the target message. Specifically, to ensure the accuracy of anomaly detection, feature extraction can be performed according to preset feature types, thereby obtaining multiple preset features of the message.

[0055] The preset feature type is used to restrict the types of preset features. The preset feature type is obtained by analyzing abnormal messages using a decision tree. Decision tree analysis can identify the features with the highest correlation to anomalies from various message features, thus enabling accurate anomaly detection. Optionally, in some implementations, the preset feature type can be determined based on the Random Forest algorithm. Further details on this will be provided below and will not be repeated here.

[0056] Decision tree-based analysis involves mapping each feature of a message to a node in a tree structure, the hierarchical relationships between features to parent-child relationships within the tree, and the specific values ​​of features to branches within the nodes. In this way, the decision tree allows for the selection of features closely associated with anomalies from the multiple features present in the message—the preset feature types. Feature extraction based on these preset feature types can then identify features strongly correlated with anomalies from the target message, enabling identification based on these preset features.

[0057] S103: Input multiple preset features of the target message into the RNN model to obtain the anomaly detection results of the target message.

[0058] After obtaining multiple preset features, these features of the target message can be input into an RNN model. By analyzing the preset features of the target message using the RNN model, it can be determined whether the target message is abnormal.

[0059] Optionally, the RNN model used for anomaly detection can be a bidirectional RNN (BIRNN) model. The BIRNN model enhances the architecture of RNN models by improving their ability to capture long-term dependencies when processing sequence data. In the BIRNN model, information flow is bidirectional. For any time step t, the BIRNN model can fuse information from all time steps before and after t, forming a more comprehensive contextual understanding. This allows for more comprehensive identification of target messages and more accurate detection of anomalies.

[0060] This application provides an anomaly detection method. First, it determines whether a message has an anomaly. Specifically, after acquiring the target message to be judged, features of the target message can be extracted according to preset feature types. Then, the features extracted from the target message can be input into a Recurrent Neural Network (RNN) model. The RNN model analyzes the features of the target message to obtain the anomaly detection result. The preset feature types are determined based on the analysis of anomaly-causing messages using decision trees, and are the types of features among the various features of the target message with the highest correlation to anomalies. Therefore, by extracting features from the target message based on preset feature types, multiple preset features with the highest correlation to anomalies can be found from the target message. Because of their high correlation with anomalies, preset features can better reflect whether the target message has an anomaly compared to non-preset features. Thus, by extracting specific features from the target message according to preset feature types for anomaly detection, accurate anomaly detection results can be obtained.

[0061] The following is combined with Figure 2 This paper introduces the process of determining the preset feature types and training the RNN model.

[0062] See Figure 2 , Figure 2 A flowchart of a model training method provided in this application embodiment includes:

[0063] S201: Obtain multiple sample messages.

[0064] To determine the preset feature types and train the RNN model, multiple training sample messages can first be obtained. These multiple sample messages can include multiple abnormal sample messages and multiple normal sample messages. Abnormal sample messages are those that exhibit anomalies, while normal sample messages are those that do not exhibit anomalies.

[0065] Optionally, the sample messages can be preprocessed before determining the original features. For example, the sample messages can be formatted and cleaned. Alternatively, the sample messages can be standardized, for example, by organizing them into standardized fields. Standardized fields may include, for example, message length, IP address, protocol type, message header, message time interval, transaction amount, transaction parties, transaction date, and remarks.

[0066] Optionally, sample exception messages can correspond to different types of exceptions or the same type of exception. Optionally, exception tags can be added to sample exception messages. Exception tags indicate the exception type of the sample exception message, and may include exceptions such as protocol exceptions, internal system exceptions, insufficient resource exceptions, security-related exceptions, performance exceptions, server-side exceptions, and client-side exceptions.

[0067] If the sample abnormal messages correspond to the same type of abnormality, the statistical analysis can be performed based on that type of abnormality when building the decision tree below. If the sample abnormal messages correspond to different types of abnormalities, the statistical analysis can be performed based on the different types of abnormalities. For example, suppose sample message A has an abnormality of type X but no abnormality of type Y. Then, when building the decision tree, message A can be treated as a normal message for abnormality of type Y.

[0068] S202: Determine the multiple original features of the sample message and the candidate values ​​for each original feature.

[0069] After obtaining multiple sample messages, feature extraction can be performed on the sample messages to determine multiple original features of the sample messages, as well as the values ​​of each original feature corresponding to multiple sample messages.

[0070] Here, the original features are the characteristics of the sample messages. A class of original features refers to features of the same type that exist in multiple sample messages. The values ​​of the same class of original features can be different in different sample messages. The candidate values ​​of original features refer to the possible values ​​of a sample message for a certain class of original features. That is, assuming feature extraction is performed on multiple sample messages, a total of 10,000 original features can be obtained. These 100 original features can be divided into 1,000 classes of original features. For a certain class of original features, if there are 50 possible values ​​in the sample messages, then the number of candidate values ​​for this class of original features is 50.

[0071] S203: Determine the feature decision tree based on multiple original features.

[0072] After determining the original features and their candidate values, a feature decision tree can be built based on the original features to analyze the correlation between features and anomalies. Each branch node of the feature decision tree corresponds one-to-one with a single original feature, and the number of branches in a corresponding branch node is the same as the number of candidate values ​​for the original feature.

[0073] In particular, for transaction messages, since the messages themselves are highly correlated with business attributes, the importance of features can be analyzed by combining the characteristics of tree models (such as random forest models) that output a ranking of feature importance.

[0074] Specifically, when building a feature decision tree, each original feature can first be mapped to a node in the tree structure. Furthermore, the original features can be analyzed to determine the dependencies between them, thereby identifying the parent-child relationships of the nodes. The number of branches corresponding to a node is determined by the candidate values ​​of the feature. If a certain original feature has k candidate values, then that original feature has k child nodes in the tree structure, and each child node corresponds to one candidate value of the original feature.

[0075] If original feature A depends on the existence of original feature B, then in the tree structure, the node of original feature A is a child node of the node of original feature B. Furthermore, if original feature A exists in the sample message when original feature B takes the value b1, then the node corresponding to original feature A can be a child node on the branch corresponding to the candidate value b1. Similarly, if original feature B exists in the sample message when original feature B takes the value b2, then the node corresponding to original feature A can also be a child node on the branch corresponding to the candidate value b2.

[0076] Optionally, if there are multiple types of anomalies, different feature decision trees can be built based on different types of anomalies.

[0077] S204: Based on the feature decision tree, analyze the degree of influence of each original feature on the anomaly of the message.

[0078] After establishing the feature decision tree, the influence of the original features on the anomalies of the messages can be analyzed based on the feature decision tree. Specifically, the Gini coefficient of each node can be calculated separately. The Gini coefficient of a node is determined based on normal and abnormal sample messages in the sample messages. The Gini coefficient of a node represents the degree of influence of each branch (i.e., candidate value) under the feature corresponding to that node on the anomaly.

[0079] Next, the importance of each candidate value in the feature decision tree can be calculated. Specifically, the change in the Gini coefficient before and after a branch can be calculated, and this change can be used to represent the importance of the branch. Then, the importance of the same feature in different feature decision trees and different branches can be summed, and the result is the degree of influence of that feature on the anomaly of the message.

[0080] Thus, the impact of each feature on message anomalies can be calculated separately using the above method. Considering that the standards for the magnitude of the impact of different features may vary, the impact magnitude can be normalized.

[0081] S205: Based on the degree of influence, determine multiple target features from multiple original features.

[0082] After determining the degree of influence of the original features on the message anomalies, multiple target features can be identified from the original features based on this degree of influence. The type of the target feature is the aforementioned preset feature type.

[0083] Optionally, the top N original features with the highest influence among multiple original features can be determined as target features. N is a positive integer, which can be the number of pre-configured target features. Alternatively, original features with an influence greater than a preset threshold can be determined as target original features. Alternatively, automatic selection of target features can be achieved through L1 regularization (such as Lasso regression).

[0084] S206: Extract the target features of each sample message and train an RNN model based on the abnormal features of the target features.

[0085] After determining the target features, the RNN model can be trained based on these features. Specifically, features can be extracted from each sample message according to a preset feature type, and the extracted features and the labels of the sample messages (including normal and abnormal labels) can be used to train the RNN model. Optionally, the RNN model can be a BIRNN model.

[0086] exist Figure 2 In the implementation shown, for sample messages with a large number of original features and many redundant features, the model is not trained directly using the message features. Instead, a feature decision tree is first used to filter the original features, selecting the more important target features for training. Furthermore, when actually using the model, feature extraction is performed on the target messages to be monitored according to the type of the target features. In this way, redundant features are filtered out by the feature decision tree, retaining only the high-value features in the message, thus improving the accuracy of the model.

[0087] Optionally, in some possible implementations, the model can be fine-tuned during its use. Specifically, the monitoring results of the RNN model can be manually evaluated. If the monitoring results of the RNN model are found to be incorrect, the RNN model can be retrained using the correct monitoring results. In this way, by fine-tuning the RNN model, the model's accuracy can be improved, and anomaly detection can be performed more effectively.

[0088] The above describes some specific implementations of the anomaly monitoring method and model training method provided in the embodiments of this application. Based on this, this application also provides corresponding anomaly monitoring devices and model training devices. The anomaly monitoring device and model training device provided in the embodiments of this application will be described below from the perspective of functional modularity.

[0089] See Figure 3 , Figure 3 This is a schematic diagram of a structural embodiment of the anomaly monitoring device provided in this application. Specifically, Figure 3 The abnormality monitoring device 300 shown includes:

[0090] Acquisition unit 310 is used to acquire the target message;

[0091] The feature extraction unit 320 is used to extract features from the target message according to a preset feature type to obtain multiple preset features of the target message. The preset feature type is determined based on the analysis of abnormal messages using a decision tree.

[0092] The model monitoring unit 330 is used to input multiple preset features of the target message into a recurrent neural network (RNN) model to obtain the anomaly monitoring results of the target message.

[0093] In some possible implementations, the preset feature type is obtained by analyzing the influence of message features on anomalies using the Random Forest (FR) algorithm, and the recurrent neural network (RNN) model includes the bidirectional recurrent neural network (BIRNN) model.

[0094] See Figure 4 , Figure 4 This is a schematic diagram of a model training apparatus provided in an embodiment of this application. Specifically, Figure 4 The model training device 400 shown includes:

[0095] The acquisition unit 410 is used to acquire multiple sample messages, including multiple abnormal sample messages and multiple normal sample messages;

[0096] The feature determination unit 420 is used to determine multiple types of original features of the sample message and candidate values ​​for each type of original feature, wherein each sample message includes the multiple types of original features;

[0097] The decision tree building unit 430 is used to determine a feature decision tree based on the multiple original features. The branch nodes of the feature decision tree correspond one-to-one with the original features, and the number of branches of the corresponding branch nodes is the same as the number of candidate values ​​of the original features.

[0098] The impact analysis unit 440 is used to analyze the degree of impact of each original feature on the anomaly of the message based on the feature decision tree;

[0099] Feature filtering unit 450 is used to determine multiple target features from the multiple original features based on the degree of influence;

[0100] The model training unit 460 is used to extract the target features of each sample message and train a recurrent neural network (RNN) model based on the abnormal features of the target features. The RNN model is used to perform anomaly detection on the message based on the target features of the message.

[0101] In some possible implementations, the original feature includes a target original feature, and the candidate values ​​of the target original feature include target candidate values. The influence analysis unit 440 is specifically used to analyze the sample message set, determine the number of normal sample messages and the number of abnormal sample messages corresponding to each candidate value of the target original feature; and, based on the number of normal sample messages and the number of abnormal sample messages, determine the degree of influence of the target candidate value on the message abnormality.

[0102] This application also provides corresponding devices, computer storage media, and computer program products for implementing the technical solutions provided in this application.

[0103] The device includes a memory and a processor. The memory is used to store instructions or code, and the processor is used to execute the instructions or code to enable the device to perform the anomaly monitoring method or model training method described in any embodiment of this application.

[0104] The computer storage medium stores code. When the code is run, the device running the code implements the anomaly monitoring method or model training method described in any embodiment of this application.

[0105] The computer program product contains instructions. When run on a computer, it causes the computer to execute the anomaly detection method or model training method described in any embodiment of this application.

[0106] In the embodiments of this application, the terms "first" and "second" (if they exist) are used only as name identifiers and do not represent the order of first and second.

[0107] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that all or part of the steps in the methods of the above embodiments can be implemented by means of software plus a general-purpose hardware platform. Based on this understanding, the technical solution of this application can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as a read-only memory (ROM) / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, a server, or a network communication device such as a router) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0108] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on its differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0109] The above description is merely an exemplary implementation of this application and is not intended to limit the scope of protection of this application.

Claims

1. An anomaly monitoring method, characterized in that, The method includes: Obtain the target message; The target message is subjected to feature extraction according to a preset feature type to obtain multiple preset features of the target message. The preset feature type is determined based on the analysis of abnormal messages using a decision tree. Multiple preset features of the target message are input into a recurrent neural network (RNN) model to obtain the anomaly detection results of the target message; The training method for the RNN model includes: Acquire multiple sample messages, including multiple abnormal sample messages and multiple normal sample messages; The sample message is determined by identifying multiple types of original features and candidate values ​​for each type of original feature. Each sample message includes the multiple types of original features. The original features include target original features, and the candidate values ​​for the target original features include target candidate values. The original features are analyzed to determine the dependencies between them. The parent-child relationships of nodes are determined based on the dependencies. Based on the multiple original features, a feature decision tree is determined. The branch nodes of the feature decision tree correspond one-to-one with the original features. The number of branches of the corresponding branch nodes is the same as the number of candidate values ​​of the original features. Based on the feature decision tree, the influence of each original feature on the message anomaly is analyzed; the analysis of the influence of each original feature on the message anomaly based on the feature decision tree includes: analyzing the sample message set to determine the number of normal sample messages and the number of abnormal sample messages corresponding to each candidate value of the target original feature; and determining the influence of the target candidate value on the message anomaly based on the number of normal sample messages and the number of abnormal sample messages. Based on the degree of influence, multiple target features are determined from the multiple types of original features; Extract the target features of each sample message, and train a recurrent neural network (RNN) model based on the abnormal features of the target features.

2. The method according to claim 1, characterized in that, The preset feature type is obtained by analyzing the influence of message features on anomalies using the Random Forest (FR) algorithm, and the recurrent neural network (RNN) model includes the bidirectional recurrent neural network (BIRNN) model.

3. An anomaly monitoring device, characterized in that, The device includes: The acquisition unit is used to acquire the target message; The feature extraction unit is used to extract features from the target message according to a preset feature type to obtain multiple preset features of the target message. The preset feature type is determined based on the analysis of abnormal messages using a decision tree. The model monitoring unit is used to input the multiple preset features of the target message into a recurrent neural network (RNN) model to obtain the abnormal monitoring results of the target message. The device further includes: The acquisition unit is also used to acquire multiple sample messages, including multiple abnormal sample messages and multiple normal sample messages; A feature determination unit is used to determine multiple types of original features of the sample message and candidate values ​​for each type of original feature. Each sample message includes the multiple types of original features. The original features include target original features, and the candidate values ​​for the target original features include target candidate values. The decision tree building unit is used to analyze the original features, analyze the dependencies between the original features, determine the parent-child relationship of the nodes according to the dependencies, and determine the feature decision tree based on the multiple original features. The branch nodes of the feature decision tree correspond one-to-one with the original features, and the number of branches of the corresponding branch nodes is the same as the number of candidate values ​​of the original features. The influence degree analysis unit is used to analyze the influence degree of each original feature on the anomaly of the message based on the feature decision tree; specifically, the influence degree analysis unit is used to analyze the sample message set, determine the number of normal sample messages and the number of abnormal sample messages corresponding to each candidate value of the target original feature; and determine the influence degree of the target candidate value on the anomaly of the message based on the number of normal sample messages and the number of abnormal sample messages. A feature filtering unit is used to determine multiple target features from the multiple types of original features based on the degree of influence. The model training unit is used to extract the target features of each sample message and train a recurrent neural network (RNN) model based on the abnormal features of the target features.

4. The apparatus according to claim 3, characterized in that, The preset feature type is obtained by analyzing the influence of message features on anomalies using the Random Forest (FR) algorithm, and the recurrent neural network (RNN) model includes the bidirectional recurrent neural network (BIRNN) model.

5. An anomaly monitoring device, characterized in that, The device includes a memory and a controller, the memory being used to store instructions or code, and the controller being used to execute the instructions or code stored in the memory to implement the method as described in any one of claims 1-2.

6. A computer storage medium, characterized in that, The computer storage medium stores code, and when the code is executed, the device running the code implements the method as described in any one of claims 1-2.

Images